GitHub users targeted by dangerous new phishing threat

• Researchers discover Golssue – a new tool for extracting GitHub user emails
• It is being sold for $700 on the dark web
• Such a high-precision tool could lead to dangerous supply chain attacks

GitHub users are allegedly being targeted in a brand new phishing campaign, according to SlashNext.

The company recently published an article titled “GoIssue – The Tool Behind Recent GitHub Phishing Attacks”, detailing the tool, which, from the headline, appears to have already been put to use.

However, the article’s body mostly discusses the potential risks and the ways it could be used to facilitate targeted phishing campaigns and other cyber attacks. It outlines the features of GoIssue and how attackers “could” use it to target GitHub users, suggesting hypothetical scenarios rather than confirming any specific incidents where the tool has been deployed.

Discount for early adopters

In any case, Golssue is definitely a sophisticated hacking tool, and GitHub users should be on their guard.

SlashNext claims Golssue can extract email addresses from public GitHub profiles, and send bulk emails directly to people’s inboxes. That way, crooks could craft highly targeted, convincing phishing emails, which could result in GitHub users losing access to their profiles, or having projects compromised with malware in supply-chain attacks.

“Whether you’re aiming to reach a specific audience or expand your outreach, GoIssue offers the precision and power you need,” Golssue’s developer, a threat actor called ‘cyberdluffy’ said in an ad posted on the dark web.

To purchase a custom build of the tool, you will need to pay $700. Access to the source code can also be acquired, but for $3,000.